Siemens Issues Security Updates for Mendix Modules
The patches fix an authentication bypass vulnerability that could allow unauthenticated access to Mendix 9, 10, and 11.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Should software companies be required to provide faster security updates for their industrial products?
Siemens has released security updates to patch an authentication bypass vulnerability within its Mendix SAML modules. The vulnerability, tracked as CVE-2026-89209, impacts Mendix 9, 10, and 11 versions and allows unauthenticated remote access.
Why it matters
This vulnerability affects identity verification processes in Mendix applications, potentially exposing enterprise systems to unauthorized access if not remediated. Patching ensures that identity provider (IdP) authentication flows remain secure against assertion replay attacks.
The flaw, identified as CVE-2026-89209, requires updates to version 3.6.29 for Mendix 9 and 4.2.4 for Mendix 10 and 11. These thresholds represent the minimum patched state to mitigate the specific replay vulnerability.
The players
Siemens
A German multinational technology conglomerate that provides enterprise low-code application development platforms via its Mendix division.
CISA
The Cybersecurity and Infrastructure Security Agency is a U.S. federal agency responsible for strengthening national infrastructure security.
The details
The vulnerability involves how the Mendix Security Assertion Markup Language (SAML) module handles incoming requests during IdP-initiated authentication flows. An unauthenticated remote attacker can exploit this by replaying a valid SAML assertion—a digital document used to exchange authentication and authorization data between parties. By successfully replaying this assertion, an attacker bypasses standard login gates to gain unauthorized entry into the application.
Timeline
- 2026-10-26
Siemens releases the initial security advisory.
- 2026-10-29
CISA republishes the security advisory.
The Tech Race
This disclosure highlights the ongoing challenge of securing modular authentication components in low-code enterprise environments. It follows industry patterns for reporting high-risk security flaws to central national authorities.
Administrators managing Mendix applications should verify their current version against the 3.6.29 or 4.2.4 thresholds to ensure patch coverage. Organizations using SAML for single sign-on must prioritize these updates to prevent unauthorized remote access to their portals.
The takeaway
Maintaining strict SAML assertion validation is critical to preventing replay attacks in enterprise software. Administrators should confirm that all Mendix environments are updated to at least version 3.6.29 or 4.2.4 to remediate the identified bypass vulnerability.
Further reading
Learn more about securing enterprise platforms in our Cybersecurity section.
More information
For official guidance on patch implementation, consult the siemens industrial security operational guidelines.
Live Poll
Should software companies be required to provide faster security updates for their industrial products?
